CVE-2026-96257: Critical Stack-Based Buffer Overflow in Fast FAC1203R Gigabit Edition Routers

Executive Summary

A maximum-severity vulnerability, CVE-2026-96257, has been disclosed in the Fast FAC1203R Gigabit Edition router, firmware build 20200116_2.0.4. The flaw lives in the copy_msg_element function of the device's Device Discovery Service and results in a stack-based buffer overflow (CWE-121). According to VulDB (VDB-408707), the issue carries a CVSS 4.0 score of 10.0, is reachable over the network without authentication or user interaction, and a proof-of-concept exploit has already been published.

The vendor was reportedly contacted early during disclosure but did not respond, and no official patch or fixed firmware version has been identified as of this writing. CVE-2026-96257 is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and there is no confirmed report of active in-the-wild exploitation — the "exploit has been published" language in NVD's description refers to publicly available proof-of-concept exploit code, not confirmed real-world attacks. Given the maximum CVSS score, unauthenticated network reachability, and public exploit availability, this should still be treated as an urgent risk for any exposed device.

Vulnerability Details

Technical Analysis

The Flaw: copy_msg_element and Stack-Based Overflow

CWE-121 describes a condition where a program writes data past the boundary of a fixed-size buffer that lives on the call stack, rather than on the heap. Because the stack also holds control-flow data such as saved registers and return addresses, overwriting past the intended buffer can corrupt that adjacent data. In the worst case, an attacker who controls the overflowing input can redirect program execution, making stack-based overflows historically one of the more severe classes of memory-corruption bugs.

In FAC1203R Gigabit Edition firmware 2.0.4, the vulnerable code path runs inside the Device Discovery Service, a component whose purpose is to identify and respond to other devices on the network. The affected function, copy_msg_element, appears (per VulDB's classification) to copy data from an incoming discovery message into a fixed-size stack buffer without adequately validating the length of that data first. Because device discovery protocols are typically processed automatically and without authentication — by design, so devices can find each other on a LAN — a crafted discovery message reaching this function can overflow the buffer and corrupt adjacent stack memory.

Attack Vector

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the vulnerability is exploitable over the network, requires low attack complexity, has no additional attack requirements, needs no privileges, and needs no user interaction. Combined with high impact ratings across confidentiality, integrity, and availability for both the vulnerable system and any subsequent system it can reach (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), this is why the score reaches the maximum of 10.0. The E:P exploit-maturity component of the vector reflects that proof-of-concept exploit code exists — it does not, on its own, indicate confirmed exploitation in the wild.

Why This Matters

Device discovery services are usually built to be permissive: they need to accept and parse messages from unknown, unauthenticated peers on the local network to do their job. That design goal is in direct tension with security, because it means the parsing code is exposed to untrusted input by default. A stack-based buffer overflow in that code path removes the last line of defense — there is no login prompt or token check standing between an attacker on the network and the vulnerable function. For a consumer/SOHO router like the FAC1203R, this means any device capable of reaching the router's discovery service (which, depending on deployment, may include the WAN interface, guest networks, or any compromised device already on the LAN) could potentially trigger the overflow without ever authenticating.

Impact Assessment

Remediation

1. Identify exposed devices. Inventory every FAC1203R Gigabit Edition unit on firmware 2.0.4 (build 20200116_2.0.4) in your environment, including consumer/home deployments that may not be centrally tracked.
2. Isolate the Device Discovery Service. Where possible, disable or restrict the device discovery feature, and ensure it is never exposed to the WAN interface or untrusted networks — treat it as LAN-only at most.
3. Segment the network. Place affected routers behind additional network segmentation so that a compromise of the router cannot directly pivot to other critical assets.
4. Check for a vendor patch regularly. No fixed firmware version is available as of this advisory; because the vendor has not responded to the disclosure, monitor vendor channels and third-party advisories (VulDB, NVD) for updates.
5. Consider replacement. Given the maximum severity score, public exploit code, and lack of vendor response, organizations with a low risk tolerance should evaluate replacing affected devices with actively supported alternatives.
6. Monitor for anomalous discovery traffic. Watch for malformed or unusually large device-discovery messages targeting affected routers, which may indicate exploitation attempts.
7. Re-verify exploitation status before deprioritizing. This advisory reflects known information as of publication; re-check CISA KEV and vendor sources periodically, as status can change quickly for critical, unauthenticated, network-exploitable flaws with public PoC code.

Sources

• NVD — CVE-2026-96257 Detail
• VulDB — VDB-408707: Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element Stack-Based Overflow